MedusaLocker

MedusaLocker, first observed in September 2019, is a potent ransomware variant that primarily targets Windows machines through spam. This malware should not be confused with Medusa, a Ransomware-as-a-Service (RaaS) platform active since late 2022. MedusaLocker has been utilized by various ransomware operations, including AvosLocker, BlackCat, Trigona, and LockBit. It appends the ".crypto1317" extension to infected files and drops a ransom note named "How_to_back_files.html". Like other ransomware, it terminates specific services by referencing a hardcoded list of services. The MedusaLocker variant was notably successful in infecting and encrypting systems, particularly within the healthcare sector. According to a February 2023 report by the US Department of Health and Human Services, the malware leveraged the confusion and disorder during the COVID-19 pandemic to launch attacks. After initial access, MedusaLocker spreads through a network via a batch file executing a PowerShell script. This process disables security and forensic software, restarts the machine in safe mode to evade detection, and then employs AES-256 encryption to lock files. Despite being lesser-known, MedusaLocker's impact has been significant on a global scale, with its strains seen in Singapore’s threat landscape reflecting global trends. Its deployment has been alongside other common RaaS models such as LockBit and DeadBolt. The new MedusaLocker variant was discovered by PCrisk, highlighting the ongoing evolution and threat posed by this malware. As such, caution should be exercised when dealing with suspicious downloads, emails, or websites, as these are common infection vectors for such malicious software.